Commit 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") added checks to prevent malformed checksum metadata from causing software checksum completion to corrupt the IPv4 header. skb_csum_hwoffload_help() can also complete checksums in software when the available device features cannot satisfy the checksum request. This path was not covered by the earlier validation. For IPv4 packets, ensure that the fixed network header is accessible and validate the checksum start before calling skb_checksum_help(). Return -EINVAL on failure so callers discard the packet rather than complete the checksum using invalid metadata. Leave hardware-offloaded checksums and SCTP CRC handling unchanged. Fixes: 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") Signed-off-by: Dmitrii Iakunin --- net/core/dev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/core/dev.c b/net/core/dev.c index 3ac700d37e59..77c40e914e5f 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4130,6 +4130,11 @@ int skb_csum_hwoffload_help(struct sk_buff *skb, } sw_checksum: + if (vlan_get_protocol(skb) == htons(ETH_P_IP)) { + if (!pskb_network_may_pull(skb, sizeof(struct iphdr)) || + ip_check_csum_start(skb)) + return -EINVAL; + } return skb_checksum_help(skb); } EXPORT_SYMBOL(skb_csum_hwoffload_help); -- 2.52.0